How do I get gpg to generate a GPG Key public ring rather than a keybox?

Matthew_Rathbone_18818 0
Viewed 1085

I'm trying to take a public key and add it to /etc/apt/trusted.gpg.d/, but I'm getting an incompatibility issue.

I run:

gpg --no-default-keyring --keyring /etc/apt/trusted.gpg.d/example.gpg --import file.asc

Which works.

But then when I use apt-key list it says the key is incompatible.

Looking at the file types, my example.gpg is of type GPG keybox database version 1, where as the other apt keys are of type GPG key public ring.

How do I get gpg to generate a GPG key public ring rather than a keybox?

apt gnupg
2 Answers

I know that this is old, but since I spent some time finding a solution, I am going to share it.

GnuPG has always been a pain, when it comes to automation and there doesn't seem to be a way, to make it use the old keyring v4 format. However it can be done by re-exporting the key. Here an ugly one-liner with the MariaDB repo as an example:

# cd /etc/apt/trusted.gpg.d/ && wget -q -O - https://mariadb.org/mariadb_release_signing_key.asc | \
  gpg --no-default-keyring --keyring=$(pwd)/mariadb.gpg --batch --import - && \
  gpg --no-default-keyring --keyring=$(pwd)/mariadb.gpg --batch --output $(pwd)/mariadb.gpg~ --export --yes && \
  mv $(pwd)/mariadb.gpg~ $(pwd)/mariadb.gpg; chmod 644 $(pwd)/mariadb.gpg

This can be done much easier with apt-key and its --keyring option (tested on Debian Buster 10.7).

$ wget -q -O - https://mariadb.org/mariadb_release_signing_key.asc | \
  sudo apt-key --keyring /etc/apt/trusted.gpg.d/mariadb.gpg add -

If you look at the apt-key script you will find something similar to the one-liner above (but probably more robust). Note that apt-key will complain and fail, if you use the suffix .asc instead of .gpg for the trusted file. That seems to be a bug, that can be avoided with a previous touch on the file.

user_69171530

I also recently stumbled across this issue, and after digging into the source code, I found pretty much the perfect solution.

You can just specify the keyring format with a prefix, so gnupg-ring: or gnupg-kbx:. In your case, the command would be:

gpg --no-default-keyring --keyring gnupg-ring:/etc/apt/trusted.gpg.d/example.gpg --import file.asc

user_138798890
Related